--- id: DOM-PFM-TNL-004 title: Initial Data Load realises: CON-PFM-TNL-004 product_area: platform module: tenant-lifecycle revision: 1 status: draft design_intent: confirmed origin: services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§12.1, §12.2, §13.3 (D5, Andrew 2026-10-11); services-platform:docs/data-jobs/tenant-reset.md#§1, §2 (approved plan DJE §16) implementation_evidence: observed source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69 services-commerce: c8b66a98e2490617aec38ba5c8165dd9bd0a8f9b services-committees: 36129c24daeaadcdb339218c38cdeaff9861359d services-membership: 5994c270e8a37a30f848e99ba5b5ee6b87c08893 services-submissions: 64236c19be89579ef5897aad7de3925ed3ce03bf services-websites: 5fc6823c69d5e6f208c21dba8c0eb3132f8bdc4c services-marketing: d071a159fe9782bb71ff246d5c67d5bbfe07fbfa owned_by: SVC-PFM-TNL-tenants readable_by: - SVC-PFM-SEC-tenants lifecycle: STATE-PFM-TNL-003 custom_fields: none identity: The load uses workspace identity; every reset has its own durable job identity. attributes: - name: load record kind: collection required: true computed: false notes: The latest opening actor, time and optional bounded reason; repeated entry during loading and activation preserve it. - name: reset reason kind: text required: false computed: false notes: Optional staff explanation retained on the reset job. - name: reset plan kind: collection required: true computed: false notes: Validated removal order for the participants classified as emptied. - name: reset cursor kind: number required: true computed: false notes: Stored participant position and bounded batch progress. - name: participant results kind: collection required: true computed: false notes: Returned removal counts and inapplicable outcomes for visited participants. - name: removed totals kind: collection required: true computed: false notes: Aggregated resource totals exposed by reset inspection. - name: reset status kind: enum required: true computed: false notes: Pending, running, succeeded or failed; recovery submits a new reset. - name: reset classification kind: collection required: true computed: false notes: Platform’s declared emptied and retained lists with reasons, plus required remote reset support. - name: activation kind: computed required: false computed: true notes: Returning lifecycle to active; this has no separate load-completion record. relationships: - to: DOM-PFM-TNL-001 cardinality: one-to-one ownership: The workspace owns the opening facts on its lifecycle row. cross_service: false - to: DOM-PFM-TNL-003 cardinality: many-to-many ownership: The reset invokes classified participant behavior across service boundaries. cross_service: true invariants: - id: INV-DOM-PFM-TNL-004-01 statement: A new loading entry requires active implementation standing; a repeated entry during loading returns its existing record. enforced_at: - service provenance: observed source: services-platform:modules/tenants/services/persistence/tenants.ts:enterTenantLoading - id: INV-DOM-PFM-TNL-004-02 statement: Repeated loading entry and repeated activation of a previously loaded active workspace retain the existing facts. enforced_at: - service provenance: observed source: services-platform:modules/tenants/services/persistence/tenants.ts:enterTenantLoading, activateLoadedTenant - id: INV-DOM-PFM-TNL-004-03 statement: Activation preserves business standing and opening facts, and refuses a never-loaded active workspace. enforced_at: - service provenance: observed source: services-platform:modules/tenants/services/persistence/tenants.ts:activateLoadedTenant - id: INV-DOM-PFM-TNL-004-04 statement: Reset requires loading implementation at admission, locked creation and each batch. enforced_at: - service provenance: observed source: services-platform:modules/tenants/services/reset/tenant-reset-operations.ts (requireResetAuthority) - id: INV-DOM-PFM-TNL-004-05 statement: A database constraint permits only one pending or running reset per workspace. enforced_at: - service - database provenance: observed source: services-platform:modules/tenants/db/tenant-reset-jobs.table.ts:tenant_reset_jobs_open_uidx - id: INV-DOM-PFM-TNL-004-06 statement: Reset classification accounts for Platform participants and validates planned remote reset declarations before removal. enforced_at: - service provenance: observed source: services-platform:modules/tenants/services/lifecycle/reset-participants.ts; services/reset/reset-tenant.ts:resetPlan physical: - platform.tenants - platform.tenant_reset_jobs - platform.tenant_reset_job_steps - platform.tenant_reset_job_events evidence: - 'services-platform at ad3f6a65: modules/tenants/aws/api/hq-tenant-loading.routes.ts; services/persistence/tenants.ts (enterTenantLoading, activateLoadedTenant); services/reset/*.ts; services/lifecycle/reset-participants.ts; db/tenant-reset-job*.table.ts; docs/data-jobs/tenant-reset.md.' - 'FND-PFM-TNL-054: custom-field registration absence is not established within the permitted source scope.' --- # Initial Data Load ## What It Models Initial loading records the controlled import period and its reset attempts. The workspace keeps its latest opening facts, while durable reset jobs retain removal progress. ## Identity and Attributes The load uses workspace identity; every reset has its own durable job identity. The latest opening actor, time and optional bounded reason; repeated entry during loading and activation preserve it. Optional staff explanation retained on the reset job. Validated removal order for the participants classified as emptied. Stored participant position and bounded batch progress. Returned removal counts and inapplicable outcomes for visited participants. Aggregated resource totals exposed by reset inspection. Pending, running, succeeded or failed; recovery submits a new reset. Platform’s declared emptied and retained lists with reasons, plus required remote reset support. Returning lifecycle to active; this has no separate load-completion record. ## Relationships The workspace owns the opening facts on its lifecycle row. The reset invokes classified participant behavior across service boundaries. ## Invariants The structured invariants distinguish service and database enforcement from documented obligations. The listed enforcement points bound what the workflow can rely on. ## How It Is Stored and Shared Platform’s lifecycle service owns this design object. The physical declarations identify its stored records, while shared jobs provide durable execution and inspection. ## Open Design Questions Reset does not enforce the planned check for writes outside import, and activation does not inspect reset outcome. Reopening loading can replace previous opening facts, while application restoration differs by participant.